Analysis
-
max time kernel
299s -
max time network
282s -
platform
windows10-2004_x64 -
resource
win10v2004-20231222-en -
resource tags
arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system -
submitted
25-01-2024 17:42
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
http://mpub-proxy.didiglobal.com/hera/click?d=87HL6nm4GObs6mYNxVJuEuSjxsb378lcm0wZLyrt814FG_jKLbyXndKSHeiVXW6cqgoY6a6Lmrebwn_XfOk0XQ3db3WVOoiAQz3_s4V0QlQXYjHwNuhLC6z4k3G-5X3Phj2awQdFuPtU2x2TMo9xoJKaMd_6cuaR7uoH7wKc3HF2mJqRbk7WBLkmFyboWcjgXaGTMTNB4dTU9VCLuC8_WpsWkshacYhKAPKCpyOrbZo=__;!!D1sDotPi8BGI9gw!lexDEtgpbqlsnqcr8PSwEDC-VhcgKhiNidOypCGGKpZITVkbSlbbSEsD7NpjebqHz_tdjQatX3IZ6oGyNZ_2usg$
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
http://mpub-proxy.didiglobal.com/hera/click?d=87HL6nm4GObs6mYNxVJuEuSjxsb378lcm0wZLyrt814FG_jKLbyXndKSHeiVXW6cqgoY6a6Lmrebwn_XfOk0XQ3db3WVOoiAQz3_s4V0QlQXYjHwNuhLC6z4k3G-5X3Phj2awQdFuPtU2x2TMo9xoJKaMd_6cuaR7uoH7wKc3HF2mJqRbk7WBLkmFyboWcjgXaGTMTNB4dTU9VCLuC8_WpsWkshacYhKAPKCpyOrbZo=__;!!D1sDotPi8BGI9gw!lexDEtgpbqlsnqcr8PSwEDC-VhcgKhiNidOypCGGKpZITVkbSlbbSEsD7NpjebqHz_tdjQatX3IZ6oGyNZ_2usg$
Resource
win10v2004-20231222-en
General
-
Target
http://mpub-proxy.didiglobal.com/hera/click?d=87HL6nm4GObs6mYNxVJuEuSjxsb378lcm0wZLyrt814FG_jKLbyXndKSHeiVXW6cqgoY6a6Lmrebwn_XfOk0XQ3db3WVOoiAQz3_s4V0QlQXYjHwNuhLC6z4k3G-5X3Phj2awQdFuPtU2x2TMo9xoJKaMd_6cuaR7uoH7wKc3HF2mJqRbk7WBLkmFyboWcjgXaGTMTNB4dTU9VCLuC8_WpsWkshacYhKAPKCpyOrbZo=__;!!D1sDotPi8BGI9gw!lexDEtgpbqlsnqcr8PSwEDC-VhcgKhiNidOypCGGKpZITVkbSlbbSEsD7NpjebqHz_tdjQatX3IZ6oGyNZ_2usg$
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe -
Modifies data under HKEY_USERS 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133506781881071245" chrome.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 3936 chrome.exe 3936 chrome.exe 2712 chrome.exe 2712 chrome.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs
pid Process 3936 chrome.exe 3936 chrome.exe 3936 chrome.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 3936 chrome.exe Token: SeCreatePagefilePrivilege 3936 chrome.exe Token: SeShutdownPrivilege 3936 chrome.exe Token: SeCreatePagefilePrivilege 3936 chrome.exe Token: SeShutdownPrivilege 3936 chrome.exe Token: SeCreatePagefilePrivilege 3936 chrome.exe Token: SeShutdownPrivilege 3936 chrome.exe Token: SeCreatePagefilePrivilege 3936 chrome.exe Token: SeShutdownPrivilege 3936 chrome.exe Token: SeCreatePagefilePrivilege 3936 chrome.exe Token: SeShutdownPrivilege 3936 chrome.exe Token: SeCreatePagefilePrivilege 3936 chrome.exe Token: SeShutdownPrivilege 3936 chrome.exe Token: SeCreatePagefilePrivilege 3936 chrome.exe Token: SeShutdownPrivilege 3936 chrome.exe Token: SeCreatePagefilePrivilege 3936 chrome.exe Token: SeShutdownPrivilege 3936 chrome.exe Token: SeCreatePagefilePrivilege 3936 chrome.exe Token: SeShutdownPrivilege 3936 chrome.exe Token: SeCreatePagefilePrivilege 3936 chrome.exe Token: SeShutdownPrivilege 3936 chrome.exe Token: SeCreatePagefilePrivilege 3936 chrome.exe Token: SeShutdownPrivilege 3936 chrome.exe Token: SeCreatePagefilePrivilege 3936 chrome.exe Token: SeShutdownPrivilege 3936 chrome.exe Token: SeCreatePagefilePrivilege 3936 chrome.exe Token: SeShutdownPrivilege 3936 chrome.exe Token: SeCreatePagefilePrivilege 3936 chrome.exe Token: SeShutdownPrivilege 3936 chrome.exe Token: SeCreatePagefilePrivilege 3936 chrome.exe Token: SeShutdownPrivilege 3936 chrome.exe Token: SeCreatePagefilePrivilege 3936 chrome.exe Token: SeShutdownPrivilege 3936 chrome.exe Token: SeCreatePagefilePrivilege 3936 chrome.exe Token: SeShutdownPrivilege 3936 chrome.exe Token: SeCreatePagefilePrivilege 3936 chrome.exe Token: SeShutdownPrivilege 3936 chrome.exe Token: SeCreatePagefilePrivilege 3936 chrome.exe Token: SeShutdownPrivilege 3936 chrome.exe Token: SeCreatePagefilePrivilege 3936 chrome.exe Token: SeShutdownPrivilege 3936 chrome.exe Token: SeCreatePagefilePrivilege 3936 chrome.exe Token: SeShutdownPrivilege 3936 chrome.exe Token: SeCreatePagefilePrivilege 3936 chrome.exe Token: SeShutdownPrivilege 3936 chrome.exe Token: SeCreatePagefilePrivilege 3936 chrome.exe Token: SeShutdownPrivilege 3936 chrome.exe Token: SeCreatePagefilePrivilege 3936 chrome.exe Token: SeShutdownPrivilege 3936 chrome.exe Token: SeCreatePagefilePrivilege 3936 chrome.exe Token: SeShutdownPrivilege 3936 chrome.exe Token: SeCreatePagefilePrivilege 3936 chrome.exe Token: SeShutdownPrivilege 3936 chrome.exe Token: SeCreatePagefilePrivilege 3936 chrome.exe Token: SeShutdownPrivilege 3936 chrome.exe Token: SeCreatePagefilePrivilege 3936 chrome.exe Token: SeShutdownPrivilege 3936 chrome.exe Token: SeCreatePagefilePrivilege 3936 chrome.exe Token: SeShutdownPrivilege 3936 chrome.exe Token: SeCreatePagefilePrivilege 3936 chrome.exe Token: SeShutdownPrivilege 3936 chrome.exe Token: SeCreatePagefilePrivilege 3936 chrome.exe Token: SeShutdownPrivilege 3936 chrome.exe Token: SeCreatePagefilePrivilege 3936 chrome.exe -
Suspicious use of FindShellTrayWindow 26 IoCs
pid Process 3936 chrome.exe 3936 chrome.exe 3936 chrome.exe 3936 chrome.exe 3936 chrome.exe 3936 chrome.exe 3936 chrome.exe 3936 chrome.exe 3936 chrome.exe 3936 chrome.exe 3936 chrome.exe 3936 chrome.exe 3936 chrome.exe 3936 chrome.exe 3936 chrome.exe 3936 chrome.exe 3936 chrome.exe 3936 chrome.exe 3936 chrome.exe 3936 chrome.exe 3936 chrome.exe 3936 chrome.exe 3936 chrome.exe 3936 chrome.exe 3936 chrome.exe 3936 chrome.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 3936 chrome.exe 3936 chrome.exe 3936 chrome.exe 3936 chrome.exe 3936 chrome.exe 3936 chrome.exe 3936 chrome.exe 3936 chrome.exe 3936 chrome.exe 3936 chrome.exe 3936 chrome.exe 3936 chrome.exe 3936 chrome.exe 3936 chrome.exe 3936 chrome.exe 3936 chrome.exe 3936 chrome.exe 3936 chrome.exe 3936 chrome.exe 3936 chrome.exe 3936 chrome.exe 3936 chrome.exe 3936 chrome.exe 3936 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3936 wrote to memory of 2632 3936 chrome.exe 85 PID 3936 wrote to memory of 2632 3936 chrome.exe 85 PID 3936 wrote to memory of 1728 3936 chrome.exe 88 PID 3936 wrote to memory of 1728 3936 chrome.exe 88 PID 3936 wrote to memory of 1728 3936 chrome.exe 88 PID 3936 wrote to memory of 1728 3936 chrome.exe 88 PID 3936 wrote to memory of 1728 3936 chrome.exe 88 PID 3936 wrote to memory of 1728 3936 chrome.exe 88 PID 3936 wrote to memory of 1728 3936 chrome.exe 88 PID 3936 wrote to memory of 1728 3936 chrome.exe 88 PID 3936 wrote to memory of 1728 3936 chrome.exe 88 PID 3936 wrote to memory of 1728 3936 chrome.exe 88 PID 3936 wrote to memory of 1728 3936 chrome.exe 88 PID 3936 wrote to memory of 1728 3936 chrome.exe 88 PID 3936 wrote to memory of 1728 3936 chrome.exe 88 PID 3936 wrote to memory of 1728 3936 chrome.exe 88 PID 3936 wrote to memory of 1728 3936 chrome.exe 88 PID 3936 wrote to memory of 1728 3936 chrome.exe 88 PID 3936 wrote to memory of 1728 3936 chrome.exe 88 PID 3936 wrote to memory of 1728 3936 chrome.exe 88 PID 3936 wrote to memory of 1728 3936 chrome.exe 88 PID 3936 wrote to memory of 1728 3936 chrome.exe 88 PID 3936 wrote to memory of 1728 3936 chrome.exe 88 PID 3936 wrote to memory of 1728 3936 chrome.exe 88 PID 3936 wrote to memory of 1728 3936 chrome.exe 88 PID 3936 wrote to memory of 1728 3936 chrome.exe 88 PID 3936 wrote to memory of 1728 3936 chrome.exe 88 PID 3936 wrote to memory of 1728 3936 chrome.exe 88 PID 3936 wrote to memory of 1728 3936 chrome.exe 88 PID 3936 wrote to memory of 1728 3936 chrome.exe 88 PID 3936 wrote to memory of 1728 3936 chrome.exe 88 PID 3936 wrote to memory of 1728 3936 chrome.exe 88 PID 3936 wrote to memory of 1728 3936 chrome.exe 88 PID 3936 wrote to memory of 1728 3936 chrome.exe 88 PID 3936 wrote to memory of 1728 3936 chrome.exe 88 PID 3936 wrote to memory of 1728 3936 chrome.exe 88 PID 3936 wrote to memory of 1728 3936 chrome.exe 88 PID 3936 wrote to memory of 1728 3936 chrome.exe 88 PID 3936 wrote to memory of 1728 3936 chrome.exe 88 PID 3936 wrote to memory of 1728 3936 chrome.exe 88 PID 3936 wrote to memory of 4912 3936 chrome.exe 89 PID 3936 wrote to memory of 4912 3936 chrome.exe 89 PID 3936 wrote to memory of 4384 3936 chrome.exe 90 PID 3936 wrote to memory of 4384 3936 chrome.exe 90 PID 3936 wrote to memory of 4384 3936 chrome.exe 90 PID 3936 wrote to memory of 4384 3936 chrome.exe 90 PID 3936 wrote to memory of 4384 3936 chrome.exe 90 PID 3936 wrote to memory of 4384 3936 chrome.exe 90 PID 3936 wrote to memory of 4384 3936 chrome.exe 90 PID 3936 wrote to memory of 4384 3936 chrome.exe 90 PID 3936 wrote to memory of 4384 3936 chrome.exe 90 PID 3936 wrote to memory of 4384 3936 chrome.exe 90 PID 3936 wrote to memory of 4384 3936 chrome.exe 90 PID 3936 wrote to memory of 4384 3936 chrome.exe 90 PID 3936 wrote to memory of 4384 3936 chrome.exe 90 PID 3936 wrote to memory of 4384 3936 chrome.exe 90 PID 3936 wrote to memory of 4384 3936 chrome.exe 90 PID 3936 wrote to memory of 4384 3936 chrome.exe 90 PID 3936 wrote to memory of 4384 3936 chrome.exe 90 PID 3936 wrote to memory of 4384 3936 chrome.exe 90 PID 3936 wrote to memory of 4384 3936 chrome.exe 90 PID 3936 wrote to memory of 4384 3936 chrome.exe 90 PID 3936 wrote to memory of 4384 3936 chrome.exe 90 PID 3936 wrote to memory of 4384 3936 chrome.exe 90
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://mpub-proxy.didiglobal.com/hera/click?d=87HL6nm4GObs6mYNxVJuEuSjxsb378lcm0wZLyrt814FG_jKLbyXndKSHeiVXW6cqgoY6a6Lmrebwn_XfOk0XQ3db3WVOoiAQz3_s4V0QlQXYjHwNuhLC6z4k3G-5X3Phj2awQdFuPtU2x2TMo9xoJKaMd_6cuaR7uoH7wKc3HF2mJqRbk7WBLkmFyboWcjgXaGTMTNB4dTU9VCLuC8_WpsWkshacYhKAPKCpyOrbZo=__;!!D1sDotPi8BGI9gw!lexDEtgpbqlsnqcr8PSwEDC-VhcgKhiNidOypCGGKpZITVkbSlbbSEsD7NpjebqHz_tdjQatX3IZ6oGyNZ_2usg$1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3936 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff951039758,0x7ff951039768,0x7ff9510397782⤵PID:2632
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1644 --field-trial-handle=1872,i,17848146399800070667,6364519398802270895,131072 /prefetch:22⤵PID:1728
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2132 --field-trial-handle=1872,i,17848146399800070667,6364519398802270895,131072 /prefetch:82⤵PID:4912
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2180 --field-trial-handle=1872,i,17848146399800070667,6364519398802270895,131072 /prefetch:82⤵PID:4384
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2952 --field-trial-handle=1872,i,17848146399800070667,6364519398802270895,131072 /prefetch:12⤵PID:2056
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2944 --field-trial-handle=1872,i,17848146399800070667,6364519398802270895,131072 /prefetch:12⤵PID:1412
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4624 --field-trial-handle=1872,i,17848146399800070667,6364519398802270895,131072 /prefetch:12⤵PID:4372
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5140 --field-trial-handle=1872,i,17848146399800070667,6364519398802270895,131072 /prefetch:82⤵PID:4888
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4936 --field-trial-handle=1872,i,17848146399800070667,6364519398802270895,131072 /prefetch:82⤵PID:1268
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2248 --field-trial-handle=1872,i,17848146399800070667,6364519398802270895,131072 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:2712
-
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵PID:3568
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
384B
MD585dfce210f102c56be8992fd9f41dbe0
SHA1d045ba783012a7c0eb1bfbf8d3a88ce45b175d96
SHA256c6f92ad0139c80429fdc7d12476e1b1cfc01e66d9d53644ad1c6a7d345e050fa
SHA5125305db8bb40f870db34899fd6dbbbf7b2174c4f0b8ede8c20c823a6d99d31fc252cb78c148458b0398d1d142bcdb7c02cc68ba6efb6d94dce1f386f1d5e41259
-
Filesize
1KB
MD56dcefe68d76ba0e5f45ec76c802ef5dd
SHA19291f33c43c0395d268d946fca0323275a0180b9
SHA2568036d8467c4cd89e84040b27b6331721b9f8b1beed16946cb0460326853e7c87
SHA51234d32c215ce479185623daf109b1de68b90fa4556c23ce64bc53794c93f8b1b4355886e31f6f8bff19477def18cdbabac6dc904fb9ee94de7d60b12e19b70991
-
Filesize
538B
MD5c8cc82b09d07c8595125f542bcb3404e
SHA18995fa0546720dc4191fe14401ca3d9449f5d1b7
SHA256d8f622c8c664876cd4ad3bc015c651eb1b750582dafebe6035da9e19d5dabdf3
SHA512b35a81f5324df413435295f530a01c394935591f71dc8023559c01ead9cd962bb77838dfe724476bfbcc34e2ea0c941231b9eb5575569d37482f911cd06c4b3c
-
Filesize
6KB
MD57cc08312b0af22f1f22e2e3094fb5099
SHA15c6b25e7d5a86c4b52f466bb9c8635009756465d
SHA25692187473ee3f0102c106b0c6e987a0044f629867bdac5f6c22e62437547109ea
SHA512d9f53a85014f16c1907207ead6d9c1d1593b9d3c559310756031eb9abfd2e1e968e68905eca0580c684b745aa5baf0b96f1c719899ee1ea8bbd57aef21faa30c
-
Filesize
114KB
MD556cccf919a69aebc298b70059af647ac
SHA17509cd89314b3aea882ce2772334e81486cc416f
SHA256e0b63da9482bf0f3e1fb053d9cdf6ce4a36d0e63029e99b490436977720fb431
SHA5120d406b65ecaba886f0cf0b87cc30a3cc143801748e5d72adc899b0edf033b73becdadb40e0a4adf89032b7c7d4923f9e8d3803cbdfb70519f0c9e9ebdbea7307
-
Filesize
2B
MD599914b932bd37a50b983c5e7c90ae93b
SHA1bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA25644136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
SHA51227c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd